3 Cardinal Rules of Social Media Intelligence
February 5, 2019
February 5, 2019
From a simple branch of Open Source Intelligence (OSINT) to an established independent discipline, Social Media Intelligence (SOCMINT) has risen to such a primary importance that no intelligence security company can reasonably disregard the information retrieved from social network platforms without missing portions of the desired intelligence picture. Whether it is Facebook, Twitter, Instagram, LinkedIn, Tumblr or any other minor platform, SOCMINT provides data, insights and alarm bells that fit the need for timeliness and that fast pace analysts often find themselves to work at. Time-sensitive intelligence requires clear planning, creativity and a wide toolset constantly updated and running. Here are three easy reminders: the what, the how and the when SOCMINT researchers should keep in mind in their day-to-day work.
When we first study intelligence and security studies, one of the first curses that academics and professionals hurry to warn us against is the need for clarity about what the intelligence requirements (IRs) are. At the direction stage of the intelligence cycle, it is vital for consumers to let analysts know not just what the topic of the task is, which is pretty much a given, but also what the IRs are. The adage says that the more defined the IRs are, the more the analysts’ assessments will reflect the consumers’ expectations.
Conversely, the less clear the IRs, the more the analysts will need to venture themselves in the dangerous realm of interpretation, trying to identify what the consumer is interested to know – a daunting task, which easily backfires at the analysts if not properly considered. As obvious as it might sound in the theory, it is far less self-evident in the practice. The volume of data one can extract from just a basic SOCMINT research is nothing less than huge: dozens, probably hundreds of pieces of information, making sense of which is dramatically time-consuming and potentially misleading at once without a clear framework and defined research premises. The final intelligence product, in fact, will likely be affected by the so-called intelligence overload – an ancestral headache for intelligence analysts, and probably address only a small amount of the consumer’s concerns, if any at all.
The analysts were not given clear instructions and direction on what to look for and had to operate a surgical selection of what to include and what not. The lack of neat IRs risks resulting into a waste of time for the analysts and a loss of money for unsatisfied consumers: being clear about IRs is in everyone’s interest.
The etymology of the word analysis harks back to the Ancient Greek: the word is composed by ana- (up) and the verb luein (loosening). It appears in Aristotle’s texts where it means loosening up ships, unfastening and ‘releasing them from their moorings’. Figuratively, analysis also meant resolving a problem by breaking it up in simple components, which is what analysts do.
After being given a question, they will break it down into all its aspects and will therefore set up a collection plan, perform an intelligence collection, eventually process all the pieces of information found to analyse and assess the threat. Especially when it comes to SOCMINT research, such procedure can be replicated at a lower level for each stage of the intelligence cycle. In fact, proactive social media research is largely key-words based. The analyst will ideally list the key words that are likely of interest, and start checking them against the subject of the assessment. That’s the first step, that will realistically lead to a reasonable amount of evidence to collate and temporarily store.
But OSINT research is much more fun than that, and chances are that the analyst will have scratched just the first bits. Therefore, there is a need for more key words to widen the scope of your research, and here the etymology comes in handy. Breaking the problem down means considering all the related aspects of the threat, even the apparently silliest ones, and eventually drawing new lower-level areas of investigation; for each of these, the analyst will have to list down a series of key words and branch out new research paths. In other words, dismembering the question until the research cannot be further broadened, because that piece of information you’re so eager for could lay unnoticed under the most outlandish website. If analysis is about breaking down, do not indulge: you do not want to miss a thing and make your consumer unhappy.
Tools such as scrapers and aggregators are vital for busy analysts, most notably in terms of operational intelligence and SOCMINT monitoring. Such software put together multiple sources of information and funnel specific flows of information through prioritised lists and channels, allowing analysts to identify and extract relevant pieces of information and make it much quicker to observe trends, analyse patterns and therefore neutralise threats.
Social media intelligence is very often time-sensitive intelligence, and if analysts are working with social media intelligence, they will almost certainly be working under high pressure, as the nature of the intelligence is strictly related to feeding information to the consumer as soon as possible. Relying on a constantly updated (even daily, if necessary) and always running toolset is necessary to keep the analysts’ work levels high and their intelligence products strictly up-to-date, and therefore effective and usable.
There are many reasons why intelligence analysts have the best job in the world, but the one I do prefer is the need for creativity: to boost the outcome of their work, in fact analysts need to reinvent their job nearly on a daily-basis and draw new research paths based on the nature of the threat. That’s what makes the job challenging and intellectually exciting. But besides creativity, the quality of their intelligence product will also result from the positive friction between exogenous factors, such as the provision of clear direction and intelligence requirements from the consumers, and endogenous ones such as a perfectly oiled toolset machine. When such requirements are met, the analyst will best know how to handle the proverbial black box turning turn raw intelligence input into polished, timely and accurate output.
Disclaimer: The views and opinions expressed in this article are those of the authors and do not necessarily reflect the official policy or position of Grey Dynamics LTD.